feat: add --validate-auth to run authentication validation only

apps/cli/src/docker.ts

@@ -412,6 +412,7 @@ export interface WorkerOptions {
   workspace: string;
   pipelineTesting?: boolean;
   keepContainer?: boolean;
+  authOnly?: boolean;
   piAuthHostPath?: string;
 }
 
@@ -511,6 +512,9 @@ export function spawnWorker(opts: WorkerOptions): ChildProcess {
   if (opts.pipelineTesting) {
     args.push('--pipeline-testing');
   }
+  if (opts.authOnly) {
+    args.push('--validate-auth');
+  }
 
   // Inherit stderr so `docker run` daemon errors surface to the user;
   // ignore stdin/stdout (the container ID is noise).